Unit 03 of 03
Security
Input validation and sanitization, SQL injection, cross-site scripting, request forgery, password storage and authentication flows — each as a defense that takes a result out of the hands of the client or a third party and moves it to the server.
Published Updated
Lessons
- 01 Input Validation and Sanitization Narrowing a client input to the valid set with filter_var(), and measuring that validation and sanitization are separate steps and that validation does not take the power to change the value away from the client. 2 min read
- 02 Preventing SQL Injection Measuring the parameterized query that separates the query text from the client's value: the same query changes with the value under concatenation, does not change with a prepared statement, and binding does not work everywhere. 1 min read
- 03 Preventing Cross-Site Scripting Measuring how escaping narrows the result when text from a user is printed onto a page, escaping by context and double escaping; escaping does not change the owner. 1 min read
- 04 Request Forgery Protection Telling apart whether a request was made by the user's own application or by another site with a request forgery token, the measured effect of the token, and the limit of the SameSite cookie attribute. 2 min read
- 05 Password Storage Measuring that a password is stored as a hash, that a different salt gives a different hash for the same password, the cost parameter, and rehashing at login; the default cost is in the environment's hands. 2 min read
- 06 Authentication Flows Measuring the identity of a request in the session-based and the bearer-token flow, seeing what a signature protects and what it does not, and gathering the fifteen lessons of the course into one table. 2 min read